Getting Started

In this guided exercise, we will troubleshoot and resolve issues reported on an IPv4 network. First, we will launch the GNS3 network emulator and load the network environment for this lab.

1. From the dock at the bottom of the screen, click the Terminal icon to open a new Terminal window.
   
2. At the command prompt, type gns3 & and press Enter to open GNS3 in the background.
   
   It will take a few minutes for GNS3 to launch. When GNS3 opens, you will be asked to create a project or open an existing project.
   
3. In the Project window, click the Projects library tab, then select Network Troubleshooting and click OK.
   
   When prompted, click No to ignore the update check.
   

   

   This topology shows two networks (192.168.1.0/24 and 10.10.10.0/24) are connected by an IPsec VPN tunnel. Each network has a pfSense firewall, which acts as the Internet gateway.
   
4. In the topology window, right-click the Firewall-A firewall device and select Start to power up the firewall, then do the same for the Firewall-B firewall device.
   
5. In the topology window, right-click the Firewall-A firewall device and select Console to open a TigerVNC console, then do the same for the Firewall-B firewall device.
   
   You must wait for the firewalls to be fully up before continuing. Wait until you see the following menu on both firewalls before continuing with the lab:
   

   

   Note: The firewall can take up to 3 minutes to fully boot up.
   
6. Close both the Firewall-A and Firewall-B console windows.
   
7. On the GNS3 control bar, click the Start button (the large green arrow) to power on all devices.
   
   When prompted, click Yes to continue.
   
   In the GNS3 topology window, you will see all connections turn green, indicating the hosts are powered on and connected to the network.

Part 1: Troubleshoot SMB Share Connectivity

Our first issue is with Linux-A in the 192.168.1.0/24 network. The user was told to install a Samba client and then attach to an SMB share on the FILESERVER host. The user says they are not able to install a Samba client. They report the following error:

Note: We are using the Alpine Linux distribution in this lab. The apk command performs the same function as apt in Ubuntu or yum in RedHat.

The message "temporary error" indicates a network problem. While this may initially seem a bit cryptic, we will use basic network troubleshooting to resolve the issue.

1. In the GNC topology window, right-click Linux-A and select Console.
   
   A new tab called Linux-A will open in the terminal window.
   
2. In the Linux-A tab, at the command prompt, type ip a and press Enter to view the current IP Address settings, then type netstat -r and press Enter to check the gateway settings.
   

   

   You should see from the output above that we have the correct IP Address and gateway.
   
3. At the command prompt, type ping -c 4 192.168.1.1 and press Enter to test if we can reach the default gateway, then type ping -c 4 8.8.8.8 (Google's DNS servers) to test if there is general IP connectivity to the Internet.
   

   

   It appears IP connectivity from Linux-A to its default gateway and out to the Internet is working just fine.
   
4. At the command prompt, type ping -c 4 google.com and press Enter to test name resolution.
   
   Here, you should discover that name resolution is not working. Take note of the ping output.
   
5. At the command prompt, type cat /etc/network/interfaces and press Enter to see if DNS is configured on the interface, then type cat /etc/resolv.conf to see if DNS is configured there.
   

   

   You should see that resolv.conf is empty. You should also see a line in /etc/network/interfaces that would set the firewall IP as the DNS server, but it is commented out.
   
   At this point, you speak to the local system administrator for the 192.168.1.0/24 network, who tells you that they no longer use the firewall for DNS. They have instead set up an internal DNS server so that local servers, like FILESERVER, can be resolved by name. You decide to set up Linux-A to use the local DNS server (192.168.1.5).
   
6. At the command prompt, type echo "nameserver 192.168.1.5" > /etc/resolv.conf and press Enter to add a DNS server entry to resolv.conf.
   
   Use the cat command to confirm your change.
   

   

7. At the command prompt, type ping -c 4 google.com and press Enter to re-test name resolution.
   
   The results should confirm that name resolution is now working!
   
   Next, you install a Samba client for the user. It’s always good to go the extra mile!
   
8. At the command prompt, type apk add samba-client, and press Enter to install the samba client on Linux-A.
   
   Once installed, type smbclient --version and press Enter to confirm that the Samba client is installed.
   
   Using basic network troubleshooting techniques, you took a complex problem and found a simple resolution!

Part 2: Troubleshoot Internet Connectivity

Next, you are told that the user on Linux-B in the 10.10.10.0/24 network cannot connect to the Internet. According to the local system administrator, they just switched clients to DHCP for this network.

1. In the GNS3 topology window, right-click Linux-B and select Console.
   
   A new tab called Linux-B will open in the terminal window. Take note of the messages on the screen. These messages indicate that Linux-B could not get an IP configuration from a DHCP server.
   
2. At the command prompt, type udhcpc and press Enter to retry contacting the local DHCP server.
   
   Press CTRL-C to stop retrying.
   
   No luck. In speaking with the local system administrator, you learn that the local firewall should act as the DHCP server. You decide to check out the current configuration.
   
3. In the topology window, right-click the Browser-B host and select Console to open a VNC console connection to the Browser-B host.
   
   As the host's name indicates, the TigerVNC console will launch with a web browser window open. You will use the web browser to connect to the pfSense appliance's web GUI.
   
4. In the web browser, click the pfSense - Login bookmark to connect to the pfSense firewall.
   
   When prompted, ignore the security warning (Advanced > Accept the risk).
   
5. On the pfSense login page, click the Sign In button to sign in using the saved credentials.
   
6. From the menu bar at the top, click Services and select DHCP Server to open the Services / DCHP Server / LAN page.
   
   On the Services / DCHP Server / LAN page, notice that DHCP is not enabled.
   

   

7. On the Services / DCHP Server / LAN page, enter the following details, then click Save at the bottom of the page. Unless told to change a value, accept the defaults.
   
   Enable: Check Enable DHCP server on LAN interface
   Range: Set the From IP to 10.10.10.100 and the TO IP to 10.10.10.110
   DNS Servers: Set this value to the IP of the firewall - 10.10.10.1
   Gateway: Set the gateway to 10.10.10.1
   
   You will see that your DHCP server has been successfully configured in a minute or two. Because we set the firewall to act as the DNS server, let's be sure the firewall is configured to act as a DNS resolver.
   
8. From the menu bar at the top, click Services, then select DNS Resolver.
   
   We see that the DNS Resolver service is enabled. Nice!
   

   

   Note: A DNS resolver acts like a DNS server. However, unlike a DNS server, a resolver does not host any DNS zone files. The resolver’s purpose is to make DNS requests for the local clients.
   
9. In the open terminal window, in the Linux-B tab, type udhcpc and press Enter to retry contacting the DHCP server on the firewall.
   
   Notice we get an immediate response.
   

   

10. In the Linux-B tab, use ip a and netstat -r to check IP and gateway settings.
    
    You should also use cat /etc/resolv.conf to check that DNS has been set.
    
11. In the Linux-B tab, use ping to test connectivity to google.com.
    
    Success!

Part 3: Troubleshoot SMB Share Connectivity (again)

With another network troubleshooting victory under your belt, you get a call from the 192.168.1.0/24 system administrator. The user on Linux-A cannot connect to FILESERVER using the Samba client you just installed for them. It seems no good deed goes unpunished! Then again, we should have tested that before declaring victory.

1. In the open terminal window, in the Linux-A tab, type smbclient -L FILESERVER -U cybrary to list smb shares as the cybrary user.
   
   When this fails, try to ping FILESERVER. Take note of the output.
   
   You know from speaking with the system administrator that the 192.168.1.5 DNS server is supposed to resolve local server names like FILESEREVER. You decide to double-check the local zone file on 192.168.1.5.
   
2. In the topology window, right-click the Browser-A host and select Console to open a VNC console connection to the Browser-A host.
   
   As the host's name indicates, the TigerVNC console will launch with a web browser window open. You will use the web browser to connect to the local DNS server's web configuration tool.
   
3. In the web browser, click the dns bookmark to connect to the local DNS server's web configuration tool.
   
4. On the DNS server login page, click the Log In button to sign in using the saved credentials.
   
5. From the menu at the top, click Zones, then select clab.local to see the clab.local zone file.
   
   Clab.local contains the IP and hostname mappings for 192.168.1.0/24.
   

   

   You see in the clab.local zone file that only an NS and an SOA record exist. For DNS to resolve local names, there needs to be an A record for every host you want clients to resolve. Let's add an A record for FILESERVER.
   
6. On the clab.local page, click Add Record.
   
7. On the Add Record page, enter the following details, then click Save at the bottom of the page. Unless told to change a value, accept the defaults.
   
   Name: FILESERVER
   Type: A
   TTL: 3600
   IPv4 Address: 192.168.1.20
   Add reverse (PTR) record: yes
   Create reverse zone for PTR record: yes
   Overwrite existing records: no
   Comments: Local Samba Server
   
8. In the open terminal window, on the Linux-A tab, type ping -c 4  FILESERVER.clab.local and press Enter.
   
   Try pinging just FILESERVER.
   
   We are much closer now, but the user does not want to have to type the entire Fully Qualified Domain Name (FILESERVER.clab.local). Who has time for that? We must tell the local DNS client on Linux-A to assume clab.local.
   
9. On the Linux-A tab, type echo "search clab.local" >> /etc/resolv.conf and press Enter to append to the resolv.conf file and add a search domain entry.
   
   Use the cat command to verify your work.
   

   

10. Now try to ping FILESERVER.
    
    Joy at last!
    
11. At the command prompt, type smbclient -L FILESERVER -U cybrary and press Enter to list the available smb shares as user cybrary.
    
    When prompted for a password, use cybrary.
    The Samba server may be a little slow to respond. Be patient. Once it does, take note of the sharename.

Part 4: Troubleshoot VPN Connectivity

It's time for some well-earned cup of coffee, or so you think. The system administrator for 10.10.10.0/24 has a new issue. The Linux-B user can't reach FILESERVER either.  You know that 192.168.1.0/24 and 10.10.10.0/24 are connected by the two firewalls using an IPsec VPN. You aren't an IPsec expert, but someone has to look into this.

1. In the open terminal window, on the Linux-B tab, type ping -c 4  FILESERVER and press Enter.
   
   You get another bad address error. Will there be no end to name resolution issues?
   
   You could configure hosts on 10.10.10.0/24 to use the DNS server on 192.168.1.0/24, but that would push a lot of unnecessary DNS traffic over the VPN. As you are only dealing with one client now, you decide to fix the name resolution issue on the client.
   
2. On the Linux-B tab, type echo "192.168.1.20 FILESERVER" >> /etc/hosts and press Enter to append an entry for FILESERVER to /etc/hosts.
   
   Use the cat command to validate your work.
   

   

3. Ping the FILESERVER.
   
   It looks like we have a win on name resolution, but we still cannot reach 192.168.1.20.
   
   It's time to check the dreaded IPsec VPN tunnel. You should still have the pfSense firewall configurator open in Browser-B.
   
4. In the Browser-B TigerVNC console, in the open browser, click Status and select IPsec.
   
   On the Status / IPsec / Overview page, under IPsec Status, notice that the status is Disconnected. You should also see a friendly-looking green button that says "Connect P1 and P2s".
   
   You look this up online and discover that IPsec comprises two tunnels: Phase 1 (P1) and Phase 2 (P2). You read that these phases create a Security Association between two endpoints (in this case, two firewalls) and that the Security Association can time out due to networking issues. You take a chance on an easy win and press the friendly green button.
   
5. Click Connect P1 and P2s.
   
   In a few seconds, you should be rewarded with an established connection!
   

   

6. In the open terminal server, in the Linux-B tab, try once more to ping FILESERVER.
   
   Congratulations! You used simple network troubleshooting techniques and common tools to fix a number of realistic network issues on a pair of IPsec connected networks. You are now ready for a challenge!